JPMorgan, Citi Curb AI Agents Logging In With Your Password

Major US banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions, sources told Axios in a report published on 22 October 2026. Axios names Morgan Stanley, Bank of America, JPMorgan and Wells Fargo among banks racing to contain agent risks, and reports that Morgan Stanley has begun blocking third-party agents while JPMorgan, Bank of America and Citi are also restricting them.

The access usually comes through the front door. Axios describes these generally as situations when an agent or AI assistant accesses a human’s account with the user’s permission and login credentials, which goes against the guidelines of most banks requiring that humans log in to their own accounts. Of the five banks Axios names, four are blocking or restricting outside agents, by our count. As we read it, the problem is identity: a bank looking at a correct password cannot tell consent from compromise.

Business Pill · LEAST PRIVILEGE

A short Business Engineer explainer on least privilege: giving an AI agent only the access its task needs. It teaches the general idea only and says nothing about any bank or company in this piece.

What Axios Reported

• Actions beyond instructions. Some banks have tracked activity when agents contact call centers or appear to take actions independent of user instructions, the people told Axios.
• Can’t tell them apart. Many banks are broadly not able to parse whether agent account activity is user-directed, sources said. One bank executive told Axios they struggle to tell whether an agent has been authorized by a user or has gone rogue and gained access to a customer account.
• The fear. Banking executives fear the steps agents with login access might take, especially if a user has granted purchase authority or the ability to shift funds, Axios wrote. Bank executives described the situation as “horrifying”, according to Axios.
• Read-only as the middle ground. Most banks have authorized or are moving in the direction of allowing read-only access, which should allow agents to see customer financial information without taking action, Axios reported. Banks already grant such access to third-party apps like Quicken.
• Planning for failure. Banks are preparing in case worst-case scenarios happen, including with “day after” scenario planning that would allow them to quickly secure or restore customer access, sources said.

The banks also gave their own lines. A Chase spokesperson said customers should not give their usernames and passwords to anyone, and a Morgan Stanley spokesperson said the bank hasn’t observed instances of “rogue AI agents accessing our platforms,” according to Axios.

What Was Posted on X

Axios posted its scoop at 13:56 UTC on 22 October, linking to the article this piece is built on. The post says major US banks are detecting unauthorized third-party AI agents inside customer accounts, with some agents attempting actions that appear independent of user instructions. It matters here because it is the report’s central claim, sourced to people familiar with the issue.

Andrew Curran, who posts on AI companies and products, wrote this at 13:53 UTC. He says the problem seems to be that the banks cannot tell whether users have given agents permission to access their accounts, and adds, as his view, that every big AI company is launching a proactive agent with access to everything. It matters here because it puts the permission question in Axios’s report next to the wider launch of AI agents.

Rohan Paul summarised the Axios report at 13:44 UTC. His post says agents are entering accounts mostly with the customer’s own username and password, so many banks cannot tell whether activity is user-directed, and it notes Morgan Stanley says it has observed no rogue agents. It matters here because it puts the credential detail in one line; Axios itself says these are generally situations where the agent uses the user’s permission and login credentials.

The Map: Who Lets an Agent In

The table sets the banks’ reported stances beside two companies that built a separate door for agents this week.

The bank rows follow Axios’s 22 October 2026 report and the sources shown; the dates differ. The selection of rows, and the last two rows for contrast, are ours.

What the Banks Said on Their Calls

JPMorgan’s chief financial officer, Jeremy Barnum, said on the bank’s third-quarter call that some services moving money for customers rely on credential sharing, which Chase has long opposed, American Banker reported. “It’s not secure, and so to the extent that we’re able to block those, we are blocking them to protect customers and protect ourselves,” he said.

He also put the liability on the customer. “It’s important that customers understand that if they give up their credentials to the agent, and the agent does something that they don’t want, that’s going to be on them, and that’s sort of not an ideal state of things,” Barnum said, according to American Banker.

Chief executive Jamie Dimon told investors the bank was not “against agents or for agents,” CeFPro reported. Goldman Sachs chief executive David Solomon called for “rigorous testing, independent review, continuous monitoring and clear human accountability,” according to the same report.

The Arithmetic

• Four of five. Axios names five banks: Morgan Stanley, Bank of America, JPMorgan and Wells Fargo as racing to contain agent risks, and Citi among those restricting agents. Four of them, Morgan Stanley, JPMorgan, Bank of America and Citi, are reported as blocking or restricting, by our count; for Wells Fargo the sources we read report no restriction.
• Three spending limits. Walmart’s own examples for an agent’s spending limit are $50, $100 or $200, set by the customer, according to its announcement.

Connecting the Coverage

• Our piece on agents paying through Stripe covered JPMorgan, Schwab and Amazon barring agents while Stripe’s Link powered about 200 of them; its 19 October Update covered Citi and Bank of America joining, as FStech reported.
• Our piece on Walmart opening its store to AI agents covered its Agent Gateway and Agent Profiles, the other way from Amazon’s block.
• Our piece on Claude Duet buying through Stripe covered Anthropic’s proactive agent, which pays with a virtual card and treats moving money between accounts as off-limits.

The Structural Read

As we read it, the password is doing two jobs it was not built for. It proves who the customer is, and in these cases it also stands in for the customer’s permission to an agent, which the bank cannot see.

As we read it, read-only access is the banks’ answer for now. Axios reports most banks have authorized or are moving toward it, and Citi said customers could still authorise limited, read-only access through certain open-banking providers, FStech reported.

As we read it, the merchants and agent makers in our earlier coverage built a separate door instead: Walmart gives agents their own profiles and spending limits, and Anthropic’s Claude Duet pays with a virtual card and treats moving money between accounts as off-limits.

Three Implications

FOR CUSTOMERS JPMorgan’s CFO said customers who give their credentials to an agent that does something they don’t want may bear the consequences, American Banker reported.

FOR BANKS Axios reports banks are rewriting their terms of service and running “day after” scenario planning to quickly secure or restore customer access.

FOR AGENT MAKERS Axios reports bankers recognize customers will want to use agents and see the need for a middle ground, but for now the risks of being too permissive are too high.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The framework describes a governance layer and says: “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”

As we read it, the banks in Axios’s report are building the same kind of layer from the other side: deciding which agents get into a customer account, and whether they may only read or also act. The framework was published in June 2026 and does not discuss banks or this report.

What Is Not Established

Axios relies on people familiar with the issue and does not give a count of agents detected, of accounts affected or of incidents, and it does not name the agents or the AI companies behind them. Morgan Stanley says it has not observed rogue agents on its platforms. The four-of-five count is our arithmetic from the banks Axios names, and the sources we read do not say whether Wells Fargo restricts agents. JPMorgan’s, Wells Fargo’s and Goldman Sachs’s quotes come from American Banker’s and CeFPro’s reports, and Bank of America’s and Citi’s lines as FStech reported them, not from Axios.

The Bottom Line

Axios reported on 22 October 2026 that major US banks are detecting unauthorized AI agents inside customer accounts, generally logging in with the customer’s own credentials, and that Morgan Stanley is blocking outside agents while JPMorgan, Bank of America and Citi restrict them. JPMorgan’s CFO said customers who hand credentials to an agent may bear the consequences, while most banks move toward read-only access. Walmart and Anthropic’s Claude Duet instead give agents their own profiles, spending limits and virtual cards.